Lawsuit threatens to break new ground on the GPL and software licensing issues

About the author

Aaron Williamson - Aaron Williamson is an attorney at Tor Ekeland, P.C., where he counsels software companies, startups, and other technology-focused clients on business transactions, intellectual property issues, regulatory compliance, and related matters. Previously, he worked as in-house counsel at IEEE and as a staff attorney at the Software Freedom Law Center, where he advised community free and open source software projects.

Lawsuit threatens to break new ground on the GPL and software licensing issues

When Versata Software sued Ameriprise Financial Services for breaching its software license, it unwittingly unearthed a GPL violation of its own and touched off another lawsuit that could prove to be a leading case on free and open source software licensing. This post takes a look at the legal issues raised by both cases and what they mean for FOSS producers and users.

Versata v. Ameriprise

Versata provides software for the financial services industry and for 13 years had licensed its Distribution Channel Management software (DCM) to Amerprise, which used the software to manage its network of independent financial advisors. A dispute arose between the two companies regarding Ameriprise's use of third-party contractors to produce customizations to DCM. Versata claims the contractors' activities (specifically decompiling Versata's software) were prohibited by the license agreement; Ameriprise claims Versata had approved its use of contractors for years, and was objecting now only to force Ameriprise to Versata's newer, more expensive cloud-based software. Versata sued Ameriprise in Texas state court for breach of the software license agreement (but not for copyright infringement).

During the discovery process, Ameriprise obtained documents from Versata showing that DCM contained third-party free and open source software, including an XML parsing utility called VTD-XML, which is produced by a company called XimpleWare and licensed under GPL version 2. (XimpleWare also offers proprietary licenses to customers who do not wish to apply the GPL to their own software, but Versata did not have a proprietary license to VTD-XML.) Armed with these facts, Ameriprise countersued, alleging that Versata's inclusion of VTD-XML caused the whole of DCM to be licensed under the GPL, and that Ameriprise's modifications and decompilation were consistent with the GPL.

GPL, FUD, and the CDC

Lawyers for commercial software vendors have feared a claim like this for essentially the entire 20-odd-year lifetime of the GPL: a vendor incorporates some GPL-licensed code into a product—maybe naively, maybe willfully—and could be compelled to freely license the entire product as a result. The documents filed by Amerprise in the case reflect this fearful atmosphere, adopting the classically fear-mongering characterization of the GPL as a "viral" license that "infects" its host and "requires it to become open source, too." It's unfortunate that these ideas are still in circulation, even among lawyers who should know better. The "virus" analogy in particular is badly flawed. The GPL isn't communicated invisibly: whether it's used correctly, incorrectly, or not at all is a matter of basic education and diligence. And the likelihood that a court will order a party to release its infringing product under the GPL is exceedingly slim—money damages or an injunction against further distribution are far likelier outcomes.

But for procedural reasons, this won't be the case that settles this issue. When Ameriprise counterclaimed in state court that Versata breached the GPL's copyleft requirement, Versata argued that the claim could not be heard by the court because it was a copyright claim, and the federal Copyright Act preempts any state claim within the Act's ambit. Ameriprise removed the case to federal district court, which took the case up solely to resolve the issue of whether the breach-of-copyleft claim was preempted. The court held that the GPL's copyleft provision imposed an obligation over and above what the Copyright Act requires—an affirmative obligation to provide source, rather than simply an obligation not to copy the software without permission. Because the Copyright Act does not specifically protect the right of a software licensee to receive source code, the court ruled, it does not preempt a claim in state court to enforce that right.

Finding the claim not preempted, and finding no other basis for federal jurisdiction, the federal court remanded the case back to Texas state court. If the case is litigated to final judgment, then, it will have no precedential effect in any federal copyright action.

Revisiting Jacobsen v. Katzer

One inevitable question the district court's ruling raises is how, if at all, it relates to the Federal Circuit's ruling in Jacobsen v. Katzer. Jacobsen held that the breach of a free/open source software license was an infringement of the underlying copyrights if the breach was of a "condition," or a term that "limits the scope" of the license, rather than a "covenant," or a promise made in return for the license. The answer is very important for software producers: if a breach of the license is copyright infringement (i.e., because the provision breached was a condition), the copyright holder can sue in federal court, request an injunction preventing further distribution of the software, and seek statutory damages; if it's merely a breach of contract (i.e., because the relevant provision was a covenant), these remedies are not available to the copyright holder. Jacobsen held that the licensee's obligations in an open source license (specifically the Artistic License, used mainly by the Perl community) are conditions, in part because they are essential to preserving the essential purpose of the license, which is to secure the benefits of downstream development to the original developers.

Despite touching on similar issues, the Versata ruling doesn't say anything about whether the GPL's copyleft provision is a covenant or a condition. Unlike in Jacobsen, Ameriprise does not involve an open source developer suing a licensee. Ameriprise is a licensee of both Versata's software and the third-party GPL-licensed software. Consequently, it couldn't bring a claim for copyright infringement, because it doesn't own any of the copyrights at issue. Rather, Ameriprise claimed that, as a third-party beneficiary of the GPL, it had the right to enforce the GPL's copyleft provision.

XimpleWare v. Versata and Ameriprise

Ameriprise had precious little opportunity to enjoy its clever GPL jujitsu. A few months after Ameriprise brought its counterclaim against Versata, XimpleWare filed a new lawsuit accusing both Versata and Ameriprise of infringing its patents on VTD-XML: Versata, by distributing DCM to Ameriprise in violation of the GPL; and Ameriprise, by providing copies of DCM to independent financial advisors, also in violation.

When is a distribution a 'distribution'?

XimpleWare raises the question of whether, when Ameriprise distributed GPL-licensed software to franchisees, it made a "distribution" under Section 3 of GPLv2 and was therefore required to provide the recipients with source code and the other things the GPL requires. This issue was lightly briefed by the parties for Ameriprise's motion to dismiss, which the judge ruled on in May, but won't be fully resolved until a later stage. Nonetheless, the parties' briefs preview their arguments.

Ameriprise's primary defense is that providing DCM to its independent franchisees was not "distribution," because the recipients—even the independent contractors—were all "personnel" of Ameriprise. The support for this argument is fairly weak. Ameriprise cites two copyright cases where the use of independent contractors was explicitly provided for in the applicable license agreement. GPLv2, by contrast, does not distinguish distribution to independent contractors from distribution to other third parties. Ameriprise also cites a third case which merely states a long-standing principle of patent law, that a license to "make" a patented article includes a license to have that article made by a third party, unless the license explicitly says otherwise. But if Ameriprise breached its license to XimpleWare's copyrights under the GPL, it automatically lost its license to both XimpleWare's copyrights and patents under GPLv2 Section 4. And in any case, Ameriprise doesn't allege that its distribution of DCM to independent advisors was for the purpose of having anything made.

However it comes out, this issue is an important one both for developers and corporate consumers of GPL-licensed software, because it will determine to what extent companies can restrict their contractors' redistribution of GPL-licensed software. For its part, the Free Software Foundation has always maintained that "providing copies to contractors for use off-site is distribution."

Motions to dismiss

Versata's customers all moved to dismiss XimpleWare's infringement claims against them, pointing to Section 0 of GPLv2, which says that "[t]he act of running the Program is not restricted." Because they had not distributed DCM, they argued, they had not breached the license passed on to them by Versata. The judge agreed that XimpleWare had not sufficiently alleged distribution by any Versata customer except Ameriprise and dismissed XimpleWare's direct infringement claims against those customers.

The judge also dismissed XimpleWare's induced and contributory infringement claims against Versata. Both claims require that the defendant be aware of the patents allegedly infringed, but XimpleWare did not claim in its complaint that Versata knew its patents existed. For the same reason, the judge dismissed XimpleWare's claim that Versata's infringement was willful, because "a party cannot be found to have 'willfully' infringed a patent of which the party had no knowledge."

The judge gave XimpleWare leave to amend its complaint, which XimpleWare did, adding allegations that each of the Versata customers worked with third parties who were "beneficiaries of the DCM software," and also that Versata knew of XimpleWare's patents. Whether these new allegations are sufficient to save XimpleWare's claims will depend on the outcome of a new round of motions to dismiss filed last week by the defendants.

A dangerous new issue: Does GPLv2 contain a patent license?

XimpleWare also makes a new, controversial argument in its amended complaint: that regardless of whether Versata's customers distributed VTD-XML in violation of the GPL, they infringed XimpleWare's patents by using the software, because GPLv2 does not grant a patent license-only a copyright license. Several of Versata's customers point out the consequences of this argument in their renewed motion to dismiss:

In essence, XimpleWare is saying that it can entice users to download VTD-XML under the GPL and then immediately sue them from patent infringement. This goes against the letter and the spirit of the GPL.

GPLv2 is one of the most widely used FOSS licenses, if not the most. It is the license for some of the most important and commercially valuable FOSS projects, including the Linux kernel, whose contributors include such uncomfortable bedfellows as Oracle and Google, Intel and AMD, and Cisco and Huawei. If XimpleWare is right, and a license under GPLv2 offers no protection from the licensor's patents, Linux would be a landmine for these companies, and really for any company with fewer patents than IBM.

Even without an explicit patent grant, lawyers advising businesses on FOSS issues generally agree that GPLv2 protects licensees (at least those in compliance with the license terms) from patent suits by licensors. This is because the law provides for an implied license (or judicial estoppel) where a licensor's conduct leads the licensee to believe it will not be sued, or where fairness otherwise demands that the licensor should be prevented from suing. Because the GPL encourages licensees to copy, modify, and distribute the licensed software—all conduct that would infringe any patents on the software absent a license—licensees can reasonably expect that the software's producers won't sue them for doing those things. (Adam Pugh and Laura A. Majerus of Fenwick & West discuss GPLv2's implied patent license in greater detail in this paper.)

United Healthcare Services, one of the Versata customers sued by XimpleWare, states the case for estoppel succinctly in its reply:

Plaintiff chose to distribute its software to the public under the GPL for its own commercial reasons. In so doing, Plaintiff represented to the consuming public that mere use of its software was "not restricted." Plaintiff cannot wish that representation away now that it inconveniences its litigation strategy. Plaintiff's argument's amount to a "bait and switch," seeking to recover payment for mere use that Plaintiff, through its adoption of the GPL, told the world would be unrestricted.

Those who depend on GPLv2 software should watch this case carefully. While XimpleWare's argument is unlikely to succeed, if it did it could fundamentally destabilize the millions of relationships built upon GPLv2, and upon any FOSS license that doesn't contain an explicit patent license.

Tags

About the author

Aaron Williamson - Aaron Williamson is an attorney at Tor Ekeland, P.C., where he counsels software companies, startups, and other technology-focused clients on business transactions, intellectual property issues, regulatory compliance, and related matters. Previously, he worked as in-house counsel at IEEE and as a staff attorney at the Software Freedom Law Center, where he advised community free and open source software projects.

Thanks, Ben -- I'm sorry to make you work so hard for it, but I appreciate that you put in the time! I'll keep following the case and will have more as things develop, either here or on my firm's blog.

Please contact me. I am thoroughly familiar with the GPL, a software programmer, and J.D.. There are two major point that need major revision: the narratives of case law have seriously confused the issue of copyright, conflating it with issues of fair use and 2) R. Stallman was wrong about his notions of IP, which are misinforming the "right thing to do".

Hi Mark. I am also a programmer, JD, and thoroughly familiar with the GPL. My article doesn't discuss fair use at all, so I have to disagree that I have confused fair use and copyright issues anywhere. As for Richard's notions about IP, I'm not sure that it makes sense to call them "right" or "wrong." Richard's concern is the right of individuals to be free from the coercion and control of others. He views IP (a term he would quarrel with, but we'll leave that aside) as a mechanism for such control, and so he seeks to limit its sway, at least over the software he has influence over.

Thank you for making this case more transparent. I shared the link on Facebook. The world needs attorneys doing good deeds and providing counsel to those who have been violated. America will surely be saved from destruction when we polish up the Court rooms with Justice for All and send the scoundrels to prison. In God we Trust His Divine Providence.

Whew! That's a quite a bit to wrap your head around. I'm a little bit glad the GPLv3 addresses some of these issues (specifically the patent stuff); I'd be interested to see how this entire matter affects the design of future licences.

Though I think Ximpleware v Ameriprise will likely be dropped; Ameriprise was unaware of the open code in question, so it shouldn't be held liable.

Direct patent infringement is a strict liability cause of action, meaning the infringer doesn't have to be aware of the infringement to be held liable. However, if they do know, they may be infringing "willfully," in which case the available damages increase significantly.

The arguement is that it is unreasonable to offer the software under GPLv2 without making an implied promise not to sue over patents (bait and switch). If the terms of GPLv2 were being violated though, then wouldn't that invalidate their implied right to use the patents as well?

Yes, if Versata's customers violated the conditions of the GPL, then their licenses would terminate, including any patent license. Their argument is that they could not have possibly violated the license, because all they did was run the program, something which is not subject to any of the license conditions according to Section 0.

eMBee: in this case, the company that produced the GPL'd software (XimpleWare) *does* have patents related to the software. If they're valid, anyone who uses the software needs a license (or a reason why XimpleWare should be estopped from asserting its patents against them).

While most of GNU is probably written by people who do not own patents, large portions of Linux were contributed by developers working for companies that do own patents, including many on Linux. IBM, for example, is a significant contributor to Linux and also owns huge numbers of patents. The same is true of many of the top corporate contributors to Linux: http://arstechnica.com/information-technology/2013/09/google-and-samsung...

of course that's true. but how much more likely is it that these companies will sue than eg. microsoft which does use patents against linux users and when they settle it tries to make it look like it is licensing its patents for the use of linux.

while the implied patent grant is of course important for the case at hand, i just don't think that not having that grant turns linux into a landmine.

I agree that GPLv2's lack of an explicit license should not turn Linux into a landmine. What I am saying in this post is that, if XimpleWare's claim succeeds, it will open Linux users up to similar claims. While most Linux contributors are unlikely to file patent claims against compliant users, various circumstances -- including the acquisition of a contributing company by another company less friendly to free software -- could increase that likelihood over time.

The Free Software Foundation urges all software developers to advance to version 3 of the GNU General Public License. One of its improvements is that it explicitly addresses the issue of patents, as well as what activities are covered (it no longer uses the term
"distribute").

The best thing to do is to release under GPL version 3-or-later so that, if we ever have to make a GPL version 4, your code won't be incompatible with new versions of programs that will be released under GPL version 4-or-later.

I agree, Richard -- as weak as this claim may be with respect to GPLv2, it would be very clearly untenable under GPLv3. Developers who wish to provide more clarity on patent issues to their users, or who wish to prevent a fellow contributor or downstream distributor from making a claim like XimpleWare's, should consider adopting GPLv3-or-later instead.

The right FOSS license choice for a particular FOSS project depends upon a number of factors. Copyleft licenses, such as the AGPL, GPL, and CC SA licenses, are great for requiring downstream users/distributors to provide their improvements under the same license and creating barriers to closed-source use but can also have a negative impact on project adoption. Permissive licenses, such as the MIT, BSD, and Apache, are great for encouraging widespread adoption, but do not impede closed-source use of the software. Weak (or file-level) copyleft licenses, such as the LGPL, MPL, and EPL, offer a middle ground with a less expansive copyleft effect that more users can accept while still requiring distributed modifications to the FOSS project to made available under the same license.

Further, even if you have decided on the GPL license, choosing version 3 is not an open-and-shut case. Due the GPL 2 and GPL 3 incompatibility, a project that intends its software to be directly combined with existing GPL 2 code, such as the Linux kernel, would probably be better of choosing GPL 2 rather than GPL 3. Further, while the GPL 3 patent provisions may help users and distributor of the software, the patent provisions may also impede adoption of the project among relevant patent holders. Accordingly, when choosing a FOSS license, FOSS projects should consider a number of different factors including the need or desire for access to and use of downstream modifications and combined software and the need or desire for widespread use and adoption.

All true, Andrew. My comment was addressed (probably not clearly enough) to developers who have already chosen the GPL for a *new* project, and wondering which version to adopt. It is probably Richard's preference that developers choose GPLv3+ over all other licenses where possible -- that is, after all, why he downgraded the LGPL from the "Library" to the "Lesser" GPL.

This article concentrates on whether Ameriprise has a patent license due to the GPL implied patent grant. But isn't the core issue that Versata madeno effort to comply with the GPL so are clearly in breach so downstream users have no licence either? Or is that in doubt for some reason? This seems to me to be the important (and most interesting) part of this case. Do we think that these is any value in the argument that downstream users (Ameriprise onwards) have useful rights to the code even if Versata supplied them with (effectively) unlicensed/copyright-infringing software?

That's an excellent question, and would be an issue with most software licenses. However, recipients of GPL-licensed software receive a license directly from the authors -- they do not receive a sublicense from the party that distributed the software to them. Thus, they don't necessarily lose their rights simply because the intermediary is in violation of the license. This is made explicit in Section 4 of GPLv2:

"You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. **However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.**"

From the GPL v 2: "For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program."

The GPL implies that recipients of the licensed program can use it without having to pay a patent royalty. So XimpleWare is wrong.

The opinions expressed on this website are those of each author, not of the author's employer or of Red Hat.

Opensource.com aspires to publish all content under a Creative Commons license but may not be able to do so in all cases. You are responsible for ensuring that you have the necessary permission to reuse any work on this site. Red Hat and the Shadowman logo are trademarks of Red Hat, Inc., registered in the United States and other countries.